Hello,
this far I accessed my Ceph (0.48) FS with the client.admin key, but I'd like
to change that since I don't want to allow clients to control the cluster.
I thought I should create a new key, give it some caps (don't exactly know
which ones), and distribute it to clients. Here are some things I don't
know/understand:
* What do the r, w, x, and * caps ("permissions"?) mean on a mon, mds, or osd?
* What's the difference between (for example) 'allow rw' and 'rw' caps? `ceph
auth` seems to understand (and display as specified) both forms.
Not to run into issues with caps, I've created a key with the same caps as the
current client.admin, but with a different key, called client.access_fs. I
planned to narrow down the caps after I made the mount work with the new key.
$ sudo ceph auth list
installed auth entries:
[...]
client.access_fs
key: AQ...==
caps: [mds] allow
caps: [mon] allow *
caps: [osd] allow *
[...]
I've copied the key to the client as /etc/ceph/keyring:
[client.access_fs]
key = AQ...==
I have 'keyring = /etc/ceph/keyring' in my ceph.conf [global] section on the
client. Now trying to mount the filesystem fails with
$ sudo mount /mnt/ceph
ceph-fuse[1784]: starting ceph client
ceph-fuse[1784]: ceph mount failed with (1) Operation not permitted
ceph-fuse[1782]: mount failed: (1) Operation not permitted
Adding '-o name=client.access_fs' to the command line yields the same result.
If I copy the client.admin key into the keyring file, it works. (However,
adding the same mount option again (so the name= parameter and the key name in
the file do not match), I get an error (which seems okay to me, not sure about
the correctness):
$ sudo mount /cloud/ -o name=client.access_fs
ceph-fuse[1835]: starting ceph client
ceph-fuse[1835]: starting fuse
fuse: unknown option `name=client.access_fs'
2012-07-09 16:03:18.343793 7fb0e7b8b780 -1 fuse_lowlevel_new failed
ceph-fuse[1835]: fuse finished with error 33
ceph-fuse[1833]: mount failed: (33) Numerical argument out of domain
Could you clear up the confusion in my head? :)
Thanks,
--
cc
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
